Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE Request -- MapServer -- Stack based buffer overflow [was: Re: [oss-security] Re: CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support.]
From: Josh Bressers <bressers () redhat com>
Date: Wed, 20 Jul 2011 15:40:21 -0400 (EDT)

I'm assigning IDs as such:

CVE-2011-2703 mapserver SQL injection flaws
CVE-2011-2704 mapserver stack based buffer overflows

Thanks.

-- 
    JB

----- Original Message -----
Alan, Even, thanks for your replies.

Just to clarify this one a bit yet. Two CVE identifiers (one for the
multiple SQL injection flaws, the other for the stack based buffer
overflow issue) seem to be necessary in this case (due different
versions affected):

[1]
http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

On 07/19/2011 05:32 PM, Alan Boudreault wrote:
I got new from the debian security guy yesterday. I should get the
CVE id
soon.

Thanks,
Alan

On July 19, 2011 11:28:29 am Even Rouault wrote:
Selon Jan Lieskovsky<jlieskov () redhat com>:

Jan,

I believe Alan Boudreault (MapServer team member that I've added to
the CC
list) has already asked the Debian security team to request for a
CVE
number, but without any result for now. Maybe he can confirm.

Best regards,

Even

Hello Josh, Steve, vendors,

    the following has been brought to our attention:
    [1] https://bugzilla.redhat.com/show_bug.cgi?id=722545
    [2] http://trac.osgeo.org/mapserver/ticket/3903

More from [2]:

This ticket is to track fixes to prevent SQL injections through
OGC
filter encoding (in WMS, WFS and SOS), as well as a potential SQL
injection in WMS time support.

Your system may be vulnerable if it has MapServer with OGC
protocols
enabled, with layers connecting to an SQL RDBMS backend, either
natively
or via OGR.

All versions of MapServer 4.x, 5.x and 6.x are potentially
vulnerable.
All users are ** strongly encouraged ** to upgrade to one of the
latest
releases with the fixes.

Could you allocate a CVE id for this?

Thank you&& Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]